jaredandClaude Opus 4.8
94ad84dae9
Lint / Deploy (push) Successful in 4s
Lint / Notify on failure (push) Has been skipped
Lint / PHP (phpcs PSR-12) (push) Successful in 34s
Lint / JS (eslint) (push) Successful in 9s
Lint / PHP requirements (version + extensions) (push) Successful in 44s
Security / PHP Security (semgrep) (push) Successful in 2m48s
semgrep's github-actions-mutable-action-tag rule (now running, after the pip install was fixed) flags actions/checkout@v3 as a mutable tag that could be repointed upstream (supply-chain risk). Pin all four uses to the SHA the v3 tag currently resolves to (v3.6.0), preserving behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
1005 B
YAML
33 lines
1005 B
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
|
|
jobs:
|
|
semgrep:
|
|
name: PHP Security (semgrep)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
|
|
- name: Install semgrep
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y -qq python3 python3-pip
|
|
# Debian's Python is externally managed (PEP 668); the runner is
|
|
# ephemeral so installing system-wide is fine here.
|
|
pip3 install --break-system-packages semgrep
|
|
|
|
- name: Run semgrep
|
|
run: |
|
|
semgrep --config=p/php --config=p/owasp-top-ten --error \
|
|
--exclude-rule=php.lang.security.injection.echoed-request.echoed-request \
|
|
--exclude-rule=php.lang.security.injection.tainted-filename.tainted-filename \
|
|
--exclude-rule=php.lang.security.injection.tainted-callable.tainted-callable \
|
|
.
|